Forum Discussion

Björn Lagerwall's avatar
Björn Lagerwall
Copper Contributor
Oct 15, 2020
Solved

Windows Defender cannot be started on Windows Server 2012/2016 - must be manually started

Hi all,   Replacing Sophos AV with Defender ATP.  Have a problem with defender service (via GPO or services mmc) is not automatically starting after uninstalling Sophos. I must go into Defender GUI...
security
Windows Server
  • Björn Lagerwall's avatar
    Björn Lagerwall
    Nov 24, 2020

    SOLUTION FOUND: Remove Defender AV role on server. Add it again and the service starts.

Björn Lagerwall's avatar
Björn Lagerwall
Copper Contributor
Nov 24, 2020

SOLUTION FOUND: Remove Defender AV role on server. Add it again and the service starts.

steevaavoo's avatar
steevaavoo
Copper Contributor
Apr 03, 2024

Björn Lagerwall 

 

Appreciate this is a pretty old post now and you found a solution, but I was running across a similar issue to you when trying to start Defender on Server 2016 - interacting with the WinDefend service just errored every time. This post started me on the road to the ultimate solution, so many thanks!

 

Eventually I found success by running:

 

& 'C:\Program Files\Windows Defender\MpCmdRun.exe' -wdenable

 

I used Process Monitor to see what Windows was up to when clicking the button - and this was one of the commands that were traced. I confirmed it in one of the MS articles - though it took some digging!

 

Enable Defender if it was Disabled 

 

The above got everything going. Hopefully this will help someone else in a similar situation where GUI interaction is impractical/undesirable.

Resources